Jellyfin is an open source self hosted media server. Prior to 10.11.10, a specifically crafted MKV file containing forged filename tags can be leveraged to exploit missing path ...

CVE-2026-49246

Jellyfin is an open source self hosted media server. Prior to 10.11.10, a specifically crafted MKV file containing forge

历史摘要 · 未重新核验 · NVD

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, on Windows, the document folder list...

CVE-2026-48789

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

历史摘要 · 未重新核验 · NVD

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.73.0 until 2.91.0, he LaTeX backend's handl...

CVE-2026-44022

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

历史摘要 · 未重新核验 · NVD

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.91.0, the EasyOCR model download functi...

CVE-2026-44017

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

历史摘要 · 未重新核验 · NVD

motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Versions prior to 0.44.0 contain an...

CVE-2026-55488

motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program w

历史摘要 · 未重新核验 · NVD

Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, all...

CVE-2026-57296

Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom works

历史摘要 · 未重新核验 · NVD

Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir

CVE-2026-48126

### Summary When algernon is started with `--domain` (or `--letsencrypt`, which silently turns on `--domain` at `engine

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create permission can attach a SQLite source pointing at an arbitr...

CVE-2026-47385

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create pe

历史摘要 · 未重新核验 · NVD

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.186, a sandbox volume reference (volumeId, which may also ...

CVE-2026-54319

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.1

历史摘要 · 未重新核验 · NVD

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, a path traversal vulnerability exists in open-webui's cache fi...

CVE-2026-54014

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, a pat

历史摘要 · 未重新核验 · NVD

Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload

CVE-2026-54352

## Summary `POST /api/pwa/process-zip` at `packages/server/src/api/routes/static.ts:24` accepts a builder-uploaded `.zi

历史摘要 · 未重新核验 · GitHub Advisory

skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery

## Impact Following the path-safety patches in [GHSA-wx3m-whqv-xv47](https://github.com/umanio-agency/skillctl/security

历史摘要 · 未重新核验 · GitHub Advisory

WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows...

CVE-2026-53779

WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers t

历史摘要 · 未重新核验 · GitHub Advisory

Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive

CVE-2026-44517

### Impact When processing a build contexts or `add`/`copy` instructions, a malicious server serving a Git repository o

历史摘要 · 未重新核验 · GitHub Advisory

LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand search patterns d...

CVE-2026-55443

LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components

历史摘要 · 未重新核验 · NVD

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3...

CVE-2026-54293

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research a

历史摘要 · 未重新核验 · NVD

WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG_PATH directory by...

CVE-2026-53779

WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers t

历史摘要 · 未重新核验 · NVD

A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the ...

CVE-2026-12479

A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the `DiskIOStore.make` method

历史摘要 · 未重新核验 · GitHub Advisory

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes ...

CVE-2026-54286

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts

历史摘要 · 未重新核验 · NVD

Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser...

CVE-2026-53571

Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are s

历史摘要 · 未重新核验 · NVD